emotet | ec491b73b85d0c30d734c950f51beb4fa9b3f473f331a56cf1925ce2b915cba1 | Triage

Analysis

max time kernel
51s
max time network
136s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:19

Sharing

Report Analysis Logs

General

Target

ec491b73b85d0c30d734c950f51beb4fa9b3f473f331a56cf1925ce2b915cba1.dll
Size

532KB
MD5

2f78bfc2272fe7cfaac22c0f7df530d4
SHA1

34bd493fde1244a82c97efcec9dbbf27a714f0fd
SHA256

ec491b73b85d0c30d734c950f51beb4fa9b3f473f331a56cf1925ce2b915cba1
SHA512

4a09ef1ca20ab6962d28931873ac2de80174b7aaba143036bc0e13c2d953f4a4301266d9370fdb0d7b7cc25428b6d1287c5fc1840a17cc87ba6a2ca7473ef568

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2432 regsvr32.exe
2432 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2280 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2280 wrote to memory of 2432	2280	regsvr32.exe	regsvr32.exe
PID 2280 wrote to memory of 2432	2280	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec491b73b85d0c30d734c950f51beb4fa9b3f473f331a56cf1925ce2b915cba1.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WKwzfTvhVquOwgr\shHrcWoi.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-118-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/2432-123-0x0000000000000000-mapping.dmp

Download